Numeric truncation error

🚨SEVERITY: CRITICAL — CVSS 9.6Security Advisory

TL;DR 📌

  • CVSSv3 Score: 9.6 A Numeric Truncation Error vulnerability [cwe-197] in FortiOS and FortiSASE bgp daemon may allow a configured ibgp neighbor to send malicious/malformed attributes to all connected routers via a specially crafted request Revised on 2026-11-13 00:00:00
  • Highest CVSS: 9.6 (Critical).
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-126254.

What it is

CVE-2026-126254 is a numeric truncation error (CWE-197) in the BGP daemon used by FortiOS and FortiSASE. The flaw sits in how the daemon parses attributes received from an iBGP peer.

The attack path requires the sender to already be a configured iBGP neighbor of the affected device — this is not an unauthenticated, internet-facing issue, but it does not require interactive login either. A peer that is permitted to exchange routes with the device can send a specially crafted, malformed attribute that the truncation bug mishandles. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) reflects this: network-reachable, low complexity, low privileges needed, no user interaction, and a scope change — meaning the fault in the BGP daemon can affect components beyond the daemon itself.

The impact is integrity and availability loss (C:N/I:H/A:H): no data is disclosed, but the malformed attribute can corrupt processing or crash the daemon, and because routes are propagated, the effect reaches “all connected routers” that receive the resulting bad attribute from the device — not just the local box.

Fortinet lists the affected ranges as FortiOS 8.0.0 through 8.0.1, 7.6.0 through 7.6.7, 7.4.0 through 7.4.12, and 7.2.0 through 7.2.13. FortiSASE is also named as affected, though specific version ranges for it are not given — consult the advisory for that detail.

What to do

  • Check whether BGP is enabled on affected FortiOS/FortiSASE devices and review the list of configured iBGP neighbors — this is the only reachable path for exploitation, so trimming unnecessary peerings reduces exposure.
  • Cross-check your running FortiOS version against the affected ranges (8.0.0–8.0.1, 7.6.0–7.6.7, 7.4.0–7.4.12, 7.2.0–7.2.13) and consult FG-IR-26-268 for the fixed release, since no fixed version is listed in the facts available here.
  • Apply the vendor’s patch as soon as it is confirmed available for your branch; until then, treat iBGP peer configuration changes as requiring the same scrutiny as firewall rule changes.
  • Where iBGP sessions traverse infrastructure you do not fully control, apply route filtering and attribute validation at the network edge to limit the blast radius of a malformed attribute propagating to downstream routers.
  • Monitor the BGP daemon for crashes or restarts on affected devices as a possible indicator of attempted exploitation, given the daemon crash/corruption impact described in the advisory.

For leadership 🧭

Executive summary. A critical flaw in the BGP daemon used by FortiOS and FortiSASE lets an already-configured internal routing peer send a malformed attribute that can crash the daemon and spread corrupted route data to every connected router. Fortinet has not yet published a fixed release, so exposure review and peer tightening need to happen now rather than waiting for a patch.

Why it matters:

  • Exploitation requires only a configured iBGP neighbor relationship, not interactive login or internet access, so any device already peering with an untrusted or less-trusted network is exposed.
  • The CVSS scope change (S:C) and ‘all connected routers’ wording mean a single malformed attribute does not stay contained to the originating daemon — it can corrupt routing state on every downstream router that receives it.
  • Impact is integrity and availability loss, not data theft: expect daemon crashes or route corruption rather than disclosure, which can translate directly into routing outages across the network.
  • Affected ranges span four FortiOS branches (7.2.x, 7.4.x, 7.6.x, 8.0.x) plus FortiSASE, but no fixed version is listed yet, so devices on these branches with BGP enabled remain exposed until Fortinet ships a release.

Now / Next / Later:

  • Now: Identify every FortiOS/FortiSASE device with BGP enabled and list its configured iBGP neighbors; any peering that isn’t strictly necessary should be removed or disabled today.
  • Next: In the next change window, confirm each device’s FortiOS version against the affected ranges (7.2.0-7.2.13, 7.4.0-7.4.12, 7.6.0-7.6.7, 8.0.0-8.0.1), check FG-IR-26-268 for a published fix, and apply it; where iBGP sessions cross infrastructure outside your control, add route filtering and attribute validation at the edge.
  • Later: Bring iBGP neighbor configuration changes into the same change-control and review process as firewall rule changes, and add BGP daemon crash/restart monitoring on affected devices as a standing detection control.

Source